勿信任何事：无需运行时软件TCB的RTOS安全机制（扩展版）
Trust Nothing: RTOS Security without Run-Time Software TCB (Extended Version)
AI总结：
本文提出一种无需运行时软件TCB的RTOS安全机制，通过能力架构和拆分子系统实现嵌入式设备的安全设计。
摘要：
嵌入式设备面临着不断扩大的威胁环境：应用软件、操作系统内核和外设中的漏洞威胁着嵌入式设备的完整性。现有的计算机体系结构防御在安全模型中最多只考虑两个威胁来源。本文旨在通过一种新颖的能力架构来填补这一空白。为此，我们结合一种适用于构建不可信操作系统的能力方法，以防止恶意设备，而无需对外设进行硬件更改。首先，我们开发并评估了围绕遗留硬件组件的完整FPGA实现的能力架构。进一步，我们展示了基于Zephyr的软实时操作系统，该系统没有运行时软件TCB。为此，我们将Zephyr的子系统拆分为小而相互隔离的组件。所有在运行时存在的子系统，包括调度器、分配器和DMA驱动程序，以及所有外设都完全不可信。我们认为我们的工作为未来安全关键嵌入式设备的更严格的安全设计奠定了基础。
英文摘要：
Embedded devices face an ever-expanding threat landscape: vulnerabilities in application software, operating system kernels, and peripherals threaten the embedded device integrity. Existing computer-architectural defenses fully consider at most two of these threat vectors in their security model. This paper aims at addressing this gap using a novel capability architecture. To this end, we combine a token capability approach suitable for building an untrusted operating system with protection against malicious devices without requiring hardware changes to peripherals. First, we develop and evaluate a full FPGA implementation of our capability architecture around legacy hardware components. Further, we present a soft real-time operating system based on Zephyr that has no run-time software TCB. To this end, we disaggregate Zephyr's subsystems into small, mutually isolated components. All subsystems that exist at run time, including scheduler, allocator and DMA drivers, and all peripherals are fully untrusted. We believe that our work offers a foundation for more rigorous security-by-design in tomorrow's security-critical embedded devices.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
